Monday, January 27, 2025
HomeVulnerabilityCritical Vulnerability in Azure Synapse Let Attackers Control other Customers’ Workspaces

Critical Vulnerability in Azure Synapse Let Attackers Control other Customers’ Workspaces

Published on

SIEM as a Service

Follow Us on Google News

The Microsoft Azure Synapse service has been identified as unsafe to use, and Orca Security has issued a security advisory for CVE-2022-29972. 

It was found that the integration runtime (IR) used by the Azure-affected services to connect to Amazon Redshift is vulnerable to this security hole in the third-party Open Database Connectivity (ODBC) data connector.

IR users, including multiple tenants, could have been affected by the flaw if a remote attacker exploited it. Here’s what Microsoft stated:-

“These certificates are specific to Azure Data Factory and Synapse Pipelines and do not pertain to the rest of Azure Synapse. The vulnerability could have allowed an attacker to perform remote command execution across IR infrastructure not limited to a single tenant.”

There was no evidence of exploitation of the vulnerability prior to the release of the patch, even though the vulnerability was mitigated on April 15.

Disclosure Timeline

Here below we have mentioned the timeline:-

  • January 4: Orca reported the issue to Microsoft.
  • March 2: Microsoft completed the rollout of the initial hotfix.
  • March 11: Microsoft identified and notified the customer affected by the researcher’s activity.
  • March 30: Orca notified Microsoft of an additional attack path to the same vulnerability.
  • April 13: Orca notified Microsoft of a second attack path to the same vulnerability.
  • April 15: Additional fixes deployed for the two newly reported attack paths as well as additional defense-in-depth measures applied.

Mitigation

To mitigate this problem, Azure cloud customers and on-premises customers with auto-updates enabled do not have to take any further steps. 

Azure Service Health Alerts are already letting Self-Hosted IR customers who don’t have auto-updates enabled on their deployments know that they should secure their deployments in order to prevent further issues.

On Microsoft’s Download Center, the company recommends the update of their self-hosted integrated reports (5.17.8154.2) to the most current version.

The “Customer Recommendations and Additional Support” section contains further information on how to mitigate CVE-2022-299.

Apart from this, 64-bit systems with the latest version of .NET Framework can install these updates, including the latest versions.

Azure’s security vulnerabilities have already been fixed twice in the past year, including by Microsoft in March. In December, a vulnerability was found, called AutoWarp, that allowed attackers to take complete control of another.

Wiz researchers also found Azure Cosmos DB, a software agent for Open Management Infrastructure (OMI), and Azure App Service to be vulnerable to the same vulnerabilities that Redmond patched up in the past year.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

White House Considers Oracle-Led Takeover of TikTok with U.S. Investors

In a significant development, the Trump administration is reportedly formulating a plan to prevent...

Critical Vulnerability in IBM Security Directory Enables Session Cookie Theft

IBM has announced the resolution of several security vulnerabilities affecting its IBM Security Directory...

Critical Apache Solr Vulnerability Grants Write Access to Attackers on Windows

A new security vulnerability has been uncovered in Apache Solr, affecting versions 6.6 through...

GitHub Vulnerability Exposes User Credentials via Malicious Repositories

A cybersecurity researcher recently disclosed several critical vulnerabilities affecting Git-related projects, revealing how improper...

API Security Webinar

Free Webinar - DevSecOps Hacks

By embedding security into your CI/CD workflows, you can shift left, streamline your DevSecOps processes, and release secure applications faster—all while saving time and resources.

In this webinar, join Phani Deepak Akella ( VP of Marketing ) and Karthik Krishnamoorthy (CTO), Indusface as they explores best practices for integrating application security into your CI/CD workflows using tools like Jenkins and Jira.

Discussion points

Automate security scans as part of the CI/CD pipeline.
Get real-time, actionable insights into vulnerabilities.
Prioritize and track fixes directly in Jira, enhancing collaboration.
Reduce risks and costs by addressing vulnerabilities pre-production.

More like this

Critical Vulnerability in IBM Security Directory Enables Session Cookie Theft

IBM has announced the resolution of several security vulnerabilities affecting its IBM Security Directory...

Critical Apache Solr Vulnerability Grants Write Access to Attackers on Windows

A new security vulnerability has been uncovered in Apache Solr, affecting versions 6.6 through...

GitHub Vulnerability Exposes User Credentials via Malicious Repositories

A cybersecurity researcher recently disclosed several critical vulnerabilities affecting Git-related projects, revealing how improper...